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Why GAO Did This Study 

To ensure the availability of 
essential government services in 
emergencies, federal agencies are 
required to develop continuity of 
operations (COOP) plans. The 
Federal Emergency Management 
Agency (FEMA), under the 
Department of Homeland Security 
(DHS), is responsible for 
disseminating guidance to federal 
agencies on developing plans, as 
well as conducting government- 
wide exercises every other year to 
assess federal continuity readiness. 
In June 2006, FEMA conducted an 
exercise called Forward Challenge 
06, to allow agencies to activate 
COOP plans, deploy essential 
personnel to alternate facilities, 
and perform essential functions. 

GAO was asked to describe the 
extent to which agencies tested 
continuity plans and procedures, 
personnel, and resources during 
the June 2006 exercise. To do this, 
GAO selected the eight civilian 
agencies with significant 
responsibilities during national 
disasters, analyzed agency exercise 
documentation, and interviewed 
officials to determine which test 
and exercise activities each agency 
included in its participation. 



What GAO Recommends 



GAO recommends that FEMA 
require agencies participating in 
future governmentwide exercises 
to document the specific test and 
exercise activities conducted. In 
commenting on a draft of this 
report, DHS agreed with GAO's 
recommendation and stated that it 
intends to refine its assessment 
program and improve the level of 
evaluation documentation. 

To view the full product, including the scope 
and methodology, click on GAO-08-185. 
For more information, contact Linda Koontz at 
(202) 512-6240 or koontzl@gao.gov. 



What GAO Found 

During Forward Challenge 06, the eight agencies GAO reviewed performed 
various test and exercise activities related to COOP plans and procedures, 
personnel, and resources. In many cases, agencies provided documentation to 
substantiate the specific test and exercise activities performed. However, in 
other cases, agencies reported conducting such activities but did not provide 
supporting documentation. Finally, agencies also reported not testing or 
exercising certain capabilities during the exercise. In these cases, 
participating agencies may have addressed these capabilities in other tests 
and exercises conducted during the year, which were outside the scope of 
GAO's review. The table below presents a summary of the extent to which 
agencies conducted various test and exercise activities during the 
governmentwide exercise. 

Agencies' inability to substantiate many of the test and exercise activities that 
they reported performing during Forward Challenge 06 was due in part to the 
absence of specific guidance on what should be documented in such 
exercises. While FEMA directed participating agencies to document issues 
and requirements for corrective action, significant findings, and important 
observations during the Forward Challenge 06 exercise, it did not require 
participating agencies to document the specific activities from their test and 
exercise programs that they conducted during the exercise. Without adequate 
records of what has been tested during a major governmentwide exercise, 
agencies lack assurance that they have adequately tested their continuity 
capabilities at the frequency outlined in FEMA guidance, which may limit their 
ability to fully evaluate their readiness to respond to a disruption. In addition, 
adequate records can reduce the potential negative impact of turnover in key 
personnel due to attrition or change in administration, and strengthen agency 
internal control capabilities. 



Agency Testing and Exercising of COOP Plans and Procedures, Personnel, and Resources 




Tested and 


Tested but not 


Not tested 


Category Test and exercise activities 


documented 


documented 


during exercise" 


Plans and Essential Functions 


4 


4 





Procedures Activation and Notification: 
Activation 


4 


3 


1 


Notification — COOP Personnel 


3 


4 


1 


Notification — Non-COOP Personnel 


1 


5 


2 


Notification — Alternate Facility 


2 


2 


4 


Notification — FEMA Operations Center 


6 


1 


1 


Debriefing 


8 








Personnel COOP Personnel Participation 


5 


3 





Resources Interoperable Communications: 
Communications Capabilities 


8 








Communication with Internal Contacts 


6 


2 





Communication with External Contacts 


4 


4 





Vital Records 


6 


2 





Backup Power 


1 


1 


6 



Source: GAO. 

^Participating agencies may have addressed these capabilities in other tests and exercises conducted 
during the year, which were outside the scope of GAO's review. 
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United States Government Accountability Office 
Washington, D.C. 20548 



November 19, 2007 

The Honorable Tom Davis 
Ranking Member 

Committee on Oversight and Government Reform 
House of Representatives 

Dear Mr. Davis, 

As you know, essential government services can be interrupted by a range 
of events, including terrorist attacks, severe weather, or building-level 
emergencies. To ensure that these services are available in emergencies, 
federal agencies are required to develop continuity of operations (COOP) 
plans. The Federal Emergency Management Agency (FEMA), under the 
Department of Homeland Security (DHS), is responsible for disseminating 
guidance to federal agencies on developing COOP plans as well as 
conducting governmentwide exercises every other year as an assessment 
of federal continuity readiness. In June 2006, FEMA conducted an exercise, 
called Forward Challenge 06, designed to allow agencies to activate their 
plans, deploy essential personnel to alternate facilities, and perform 
essential functions. 

We previously reported on COOP test, training, and exercise requirements 
at your request, 1 and determined that agency plans did not generally 
comply with FEMA's guidance. We reported that although a 
governmentwide continuity exercise hosted by FEMA in May 2004 helped 
agencies comply with test, training, and exercise requirements, few 
agencies had documented that they conducted internal tests, training, and 
exercises at the recommended frequency. 

You requested that we evaluate agency participation in Forward Challenge 
06. Specifically, we agreed to describe the extent to which selected 
agencies tested their continuity plans and procedures, personnel, and 



'GAO, Continuity of Operations: Agency Plans Have Improved, but Better' Oversight 
Could Assist Agencies in Preparing for Emergencies, GAO-05-577 (Washington, D.C: 
Apr. 28, 2005), and Continuity of Operations: Selected Agencies Could Improve Planning 
for Use of Alternate Facilities and Telework during Disruptions, GAO-06-713 (Washington, 
D.C: May 11, 2006). 
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resources during the governmentwide exercise. For purposes of our 
review, we selected eight civilian agencies because of their significant 
responsibilities under the National Response Plan, which outlines the roles 
of federal agencies in response to national disasters. Specifically, these 
eight agencies were designated as coordinators of emergency support 
functions and as such, have responsibilities for coordinating federal 
interagency support to states and other federal agencies during 
emergencies of national significance. For example, DHS is responsible for 
coordinating urban search and rescue efforts. 2 

To address our objective, we obtained and reviewed documentation 
regarding test and exercise activities during Forward Challenge 06 from the 
selected agencies. We analyzed the documentation and interviewed agency 
officials to determine which of the test and exercise activities each agency 
included in its participation in Forward Challenge 06. 

We conducted our review from May 2006 through September 2007 in 
accordance with generally accepted government auditing standards. The 
extended period of time for our analysis was due to a delay in receiving 
documentation from DHS. First, 2 days before the exercise, we were 
informed by DHS that we would not be able to observe agencies' 
participation, despite a previous agreement to do so. Subsequently, we 
requested documentation on agencies' participation. As we testified in 
April 2007, this documentation was not provided until March of this year. 3 
Based on our review of the documentation, we were able to address the 
objective. 

On October 4, 2007, we provided your office with a briefing on the results 
of this review. This report provides the briefing slides to you and officially 
transmits our recommendation to the Secretary of Homeland Security. The 
slides from the briefing are included as appendix I. 

In summary, we determined that during Forward Challenge 06, the eight 
agencies performed various test and exercise activities related to COOP 
plans and procedures, personnel, and resources. In many cases, agencies 
provided documentation to substantiate the specific test and exercise 



2 DHS, National Response Plan (Washington, D.C.: December 2004). 

3 GAO, Department of Homeland Security: Observations on GAO Access to Information on 
Programs and Activities, GAO-07-700T (Washington, D.C.: Apr. 25, 2007). 
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activities performed. However, in other cases, agencies reported 
conducting such activities but did not provide supporting documentation. 
Finally, agencies also reported not testing or exercising certain capabilities 
during the exercise. In these cases, participating agencies may have 
addressed these capabilities in other tests and exercises conducted during 
the year, which were outside the scope of our review. 

Agencies' inability to substantiate many of the test and exercise activities 
that they reported performing during Forward Challenge 06 was due in part 
to the absence of specific guidance on what should be documented in such 
exercises. While FEMA directed participating agencies to document issues 
and requirements for corrective action, significant findings, and important 
observations during the Forward Challenge 06 exercise, it did not require 
participating agencies to document the specific activities from their test 
and exercise programs that they conducted during the exercise. Without 
adequate records of what has been tested during a major governmentwide 
exercise, agencies lack assurance that they have adequately tested their 
continuity capabilities at the frequency outlined in FEMA guidance, which 
may limit their ability to fully evaluate their readiness to respond to a 
disruption. In addition, adequate records can reduce the potential negative 
impact of turnover in key personnel due to attrition or change in 
administration, and strengthen agency internal control capabilities. 



To better assist agencies in assessing their readiness to respond to 
disruptions, we recommend that the Secretary of Homeland Security direct 
the FEMA Director to require agencies participating in future 
governmentwide exercises to document the specific test and exercise 
activities conducted. 



We received written comments on a draft of our report from the Director of 
the Department of Homeland Security's GAO/OIG Liaison office. (These 
comments are reproduced in app. II) In commenting on the report, the 
Director stated that the department agreed with our recommendation. In 
addition, the Director stated that the department had already complied 
with the recommendation during Forward Challenge 06, citing the general 



Recommendation for 
Executive Action 



Agency Comments and 
Our Evaluation 
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guidance provided in Federal Preparedness Circular 65 4 as well as 
evaluations compiled by internal and external evaluators during the 
exercise. The Director stated further that the level of documentation was 
higher than we reported as demonstrated by external evaluations that he 
said did not meet GAO audit standards. 

We disagree that FEMA provided adequate guidance on documentation and 
that the level of documentation was higher than we reported. While the 
guidance provided general direction to agencies to document their test, 
training, and exercise programs, it did not specify that agencies were to 
document the extent to which each essential function and supporting 
capability was tested during this exercise. In addition, we considered the 
results of the exercise evaluations in our analysis; but in many cases, these 
evaluations did not specify which essential functions and supporting 
capabilities were tested during the exercise. The value of such 
documentation is not to meet GAO audit standards, as the Director asserts. 
Instead, as noted in our briefing, agencies need to fully document their 
exercise activities to ensure that they are following FEMA guidance, to 
mitigate the effects of potential staff turnover, and to ensure appropriate 
internal controls. Nevertheless, the Director stated that FEMA intends to 
refine its assessment program, giving specific attention to improving the 
level of evaluation documentation. The Director also included technical 
comments that we have addressed, as appropriate. 



As agreed with your staff, unless you publicly announce its contents earlier, 
we plan no further distribution of this report until 30 days after its date. At 
that time, we will send copies of this report to the Secretary of Homeland 
Security, and other interested parties. This report will also be available at 
no charge on the GAO Web site at http://www.gao.gov. 

If you or your staff have any questions about this report, please contact me 
at (202) 512-6240 or koontzl@gao.gov. Contact points for our Offices of 
Congressional Relations and Public Affairs may be found on the last page 



4 Federal Preparedness Circular 65 is guidance to the federal executive branch for use in 
developing viable and executable contingency plans that facilitate the performance of 
essential functions during any emergency. 
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of this report. Key contributions to this report were made by James R. 
Sweetman, Jr., Assistant Director; Lome Cammack; Alma Cole; Barbara 
Collier; Matthew Grote; Sairah Ijaz; Nick Marinos; Morgan Walts; and Kim 
Zelonis. 

Sincerely yours, 




Linda D. Koontz 

Director, Information Management Issues 
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October 4, 2007, Briefing to Staff of the 
Ranking Member, House Committee on 
Oversight and Government Reform 
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Attachments 2 to 9: Individual Agency Results 
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October 4, 2007, Briefing to Staff of the 
Ranking Member, House Committee on 
Oversight and Government Reform 
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Events in recent years have underscored the need for federal agencies to be prepared to respond 
effectively to a variety of emergency situations. Specifically, federal operations and facilities have 
been disrupted by a range of events, including 

• the terrorist attacks on September 1 1 , 2001 , and at Oklahoma City on April 1 9, 1 995; 

• severe weather events, such as hurricanes Katrina, Rita, and Wilma in 2005; and 

• building-level events, such as asbestos contamination at the Department of the Interior's 
headquarters. 

Such disruptions, particularly if prolonged, can lead to interruptions in essential government services. 
Prudent management, therefore, requires that federal agencies develop plans for ensuring the 
continuity of such services in emergency situations. These are referred to as continuity of operations 
(COOP) plans. These plans lay out an agency's approach to maintaining services, ensuring proper 
authority for government actions, and protecting vital assets. 
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Oversight and Government Reform 
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Presidential Decision Directive 67 established the Federal Emergency Management Agency (FEMA) 
as the lead agency for COOP planning across the executive branch. FEMA's Federal Preparedness 
Circular (FPC) 65 provides guidance to federal agencies on developing COOP plans and carrying 
out test, training, and exercise programs to ensure their effectiveness. The guidance states that 
agencies are to test and exercise plans and procedures, personnel, and resources at specific 
frequencies during each year. These tests and exercises should include the following capabilities: 

Plans and Procedures. Each agency is to exercise the capability to continue its essential 
functions — those functions that enable it to provide vital services, exercise civil authority, maintain 
safety, and sustain the economy during an emergency — on an annual basis. In addition, each 
agency should test its continuity plan's activation and notification procedures on a quarterly basis, 
including notifying COOP personnel (that is, staff needed to perform essential functions, as 
designated by the agency), non-COOP agency employees, the alternate facility, and the FEMA 
Operations Center. 1 For each exercise performed, a debriefing should be conducted for participants 
to identify weaknesses in plans and procedures and recommend plan revisions. 
Personnel. Each agency should conduct an annual exercise that involves the movement of COOP 
personnel to the agency alternate facility 2 to ensure the agency's ability to perform essential functions 
during an emergency. 



1 The FEMA Operations Center is responsible for, among other things, facilitating information sharing between FEMA and non-FEMA 
entities, and providing a status of on-going incidents, responses or potential events, during an emergency. 

2 An alternate facility provides a physical location from which to conduct essential functions if the agency's usual facilities are 
unavailable. 

4 
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Ranking Member, House Committee on 
Oversight and Government Reform 



G A O Introduction 



Accountability • Integrity • Reliability 



Resources. Each agency should conduct tests of resources required to perform essential functions. 
These tests should include quarterly tests of its communications capabilities, such as secure and 
non-secure voice, video, fax, and data connectivity, Internet access, and email; as well as annual 
exercises of its ability to communicate with internal and external key contacts. Each agency should 
also test access to vital records and critical information systems (electronic and hard-copy records 
and information systems needed to support essential functions) semi-annually, and backup power 
annually. 

FPC 65 further requires FEMA to conduct a governmentwide continuity exercise every other year as 
a tool to assess and validate federal continuity readiness. In June 2006, FEMA conducted Forward 
Challenge 06, a governmentwide continuity exercise designed to allow agencies to activate their 
COOP plans, deploy essential personnel to alternate facilities, and perform essential functions as a 
means of assessing their mission readiness. FEMA guidance for this exercise required agencies to 
respond appropriately to the exercise scenarios using their existing plans. Agencies also had the 
option to test additional capabilities or address internal scenarios if they did not interfere with the 
overall exercise or the activities of other agencies. 
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October 4, 2007, Briefing to Staff of the 
Ranking Member, House Committee on 
Oversight and Government Reform 



JLAJiL, Objective, Scope, and Methodology 



As agreed with your office, our objective was to describe the extent to which selected agencies 
tested their continuity plans and procedures, personnel, and resources during the Forward Challenge 
06 governmentwide exercise. 

For purposes of our review, we selected eight civilian agencies because of their significant 
responsibilities under the National Response Plan, which outlines the roles of federal agencies in 
response to national disasters. 3 Specifically, these eight agencies were designated as coordinators of 
emergency support functions and as such, have responsibilities for coordinating federal interagency 
support to states and other federal agencies during emergencies of national significance. For 
example, DHS is responsible for coordinating urban search and rescue efforts. The eight selected 
agencies and their respective responsibilities for emergency support functions are listed in 
attachment 1 . 



3 DHS, National Response Plan (Washington, D.C.: December 2004). 

6 
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Oversight and Government Reform 



JLAJiL, Objective, Scope, and Methodology 



To address our objective, we obtained and reviewed documentation regarding test and exercise 
activities during Forward Challenge 06 from the agencies. Documentation included internal and 
external agency after action reports and results of external evaluations conducted during the 
exercise. We analyzed the documentation to determine which of the test and exercise activities each 
agency included in its participation in Forward Challenge 06 and interviewed officials about gaps in 
their documentation. We then created summary tables outlining activities that were supported by 
documentation (identified as "tested and documented"), and activities that agencies reported as 
having conducted during the exercise but for which they did not provide documentation (identified as 
"tested but not documented"). 

We did not identify and assess other tests and exercises that agencies may have conducted during 
the year and thus, did not assess their compliance with the requirements in FPC 65. As a result, we 
are providing only a description of the capabilities tested during Forward Challenge 06. 
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Ranking Member, House Committee on 
Oversight and Government Reform 
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^ JL A™», Objective, Scope, and Methodology 



We conducted our review from May 2006 through September 2007 in accordance with generally 
accepted government auditing standards. The extended period of time for our analysis is due to a 
delay in receiving documentation from DHS. First, we were informed by DHS two days before the 
exercise that we would not be able to observe agencies' participation, despite a previous agreement 
to do so. Subsequently, we requested documentation on agencies' participation. As we testified in 
April 2007, this documentation was not provided until March of this year. 4 Based on our review of the 
documentation, we were able to address the objective. 



4 GAO, Department of Homeland Security: Observations on GAO Access to Information on Programs and Activities, GAO-07-700T 
(Washington, D.C.: Apr. 25, 2007). 
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Oversight and Government Reform 



G A O Results in Brief 
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During Forward Challenge 06, the eight agencies performed various test and exercise activities 
related to COOP plans and procedures, personnel, and resources. In many cases, agencies 
provided documentation to substantiate the specific test and exercise activities performed. However, 
in other cases, agencies reported conducting such activities but did not provide supporting 
documentation. Finally, agencies also reported not testing or exercising certain capabilities during 
the exercise. In these cases, participating agencies may have addressed these capabilities in other 
tests and exercises conducted during the year, which were outside the scope of our review. The 
following table presents a summary of the extent to which agencies conducted various test and 
exercise activities during the governmentwide exercise. 



9 
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Results in Brief 
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Agency Testing and Exercising of COOP Plans and Procedures, Personnel, and Resources 






Tested and 


Tested but not 


Not tested 


Category 


Test and exercise activities 


documented 


documented 


during exercise 5 


Plans and 


Essential Functions 


4 


4 





Procedures 


Activation and Notification: 










Activation 


4 


3 


1 




Notification — COOP Personnel 


3 


4 


1 




Notification — Non-COOP Personnel 


1 


5 


2 




Notification — Alternate Facility 


2 


2 


4 




Notification — FEMA Operations Center 


6 


1 


1 




Debriefing 


8 








Personnel 


COOP Personnel Participation 


5 


3 





Resources 


Interoperable Communications: 










Communications Capabilities 


8 










Communication with Internal Contacts 


6 


2 







Communication with External Contacts 


4 


4 







Vital Records 


6 


2 







Backup Power 


1 


1 


6 


5 Participating agencies may have addressed these capabilities in other tests and exercises conducted during the year, which were 


outside the scope of our review. 
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While FEMA directed participating agencies to document issues and requirements for corrective 
action, significant findings, and important observations during the Forward Challenge 06 exercise, it 
did not require participating agencies to document the specific activities from their test and exercise 
programs that they conducted during the exercise. The absence of specific guidance on what 
agencies should document contributed to the lack of documentation to support many of the test and 
exercise activities agencies described undertaking during Forward Challenge 06. Without adequate 
records of what has been tested during a major governmentwide exercise, agencies lack assurance 
that they have adequately tested their continuity capabilities at the frequency outlined in FEMA 
guidance, which may limit their ability to fully evaluate their readiness to respond to a disruption. In 
addition, adequate records can reduce the potential negative impact of turnover in key personnel due 
to attrition or change in administration, and strengthen agency internal control capabilities. 
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October 4, 2007, Briefing to Staff of the 
Ranking Member, House Committee on 
Oversight and Government Reform 



Results in Brief 

Recommendation and Agency Comments 



We are making a recommendation to the Secretary of Homeland Security aimed at improving the 
ability for agencies to fully assess their readiness to respond to disruptions by documenting the 
specific test and exercise activities they conduct during future governmentwide exercises. 

In written comments on a draft of this briefing, the Director of the Department of Homeland Security's 
GAO/OIG Liaison office stated that the Department agreed with our recommendation but has already 
provided adequate guidance on documentation requirements. Among other things, the Director also 
stated that that the level of documentation was higher than we reported as demonstrated by external 
evaluations that the Director said did not meet GAO audit standards. We disagree that FEMA 
provided adequate guidance on documentation and that the level of documentation was higher than 
we reported. FEMA's guidance did not specify that agencies were to document the extent to which 
each essential function and supporting capability was tested. Similarly, the results of the evaluations 
did not document the extent to which agencies tested these functions and capabilities. The value of 
such documentation is not to meet GAO audit standards, as the Director asserts. Instead, as 
described in our briefing, agencies need to fully document their exercise activities to ensure that they 
are following FEMA guidance, mitigate the effects of potential staff turnover, and ensure appropriate 
internal controls. Nevertheless, the Director stated that FEMA intends to refine its assessment 
program, giving specific attention to improving the level of evaluation documentation. In addition, the 
Director provided technical comments, which we incorporated as appropriate. 
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G A O Background 

Accountability • Integrity • Reliability *J 

Guidance 



Testing and exercising continuity capabilities are essential to demonstrating, assessing, and 
improving the ability of agencies to execute their COOP plans. Tests and exercises serve to assess, 
validate, or identify for subsequent correction specific aspects of COOP plans, procedures, and 
resources. FPC 65 outlines various tests and exercises of continuity capabilities (including plans and 
procedures, personnel, and resources) that agencies are to conduct throughout the year; they are 
not required to perform these activities during a governmentwide exercise. These activities include 
the following: 

Plans and Procedures 

• Essential functions. On an annual basis, agency personnel must exercise the agency's 
capability to continue its essential functions. 

• Activation and notification. In order to ensure proper activation of COOP plans, agencies 
must have a decision-making process for activating their plans, as well as procedures for 
notifying personnel designated as being on the COOP team (COOP personnel), non-COOP 
agency employees, the alternate facility, and the FEMA Operations Center. The guidance 
calls for each agency to test such procedures on a quarterly basis. 

• Debriefing. For each exercise performed by an agency, a comprehensive debriefing for 
participants should be conducted to identify systemic weaknesses in plans and procedures 
and recommend COOP plan revisions. 



13 



Page 18 



GAO-08-185 Continuity of Operations 



Appendix I 

October 4, 2007, Briefing to Staff of the 
Ranking Member, House Committee on 
Oversight and Government Reform 



G A O Background 

^Accountability • Integrity • Reliability *J 

Guidance 

Personnel 

• COOP personnel participation. Each agency should conduct an annual exercise that 
involves the movement of COOP personnel to the agency alternate facility to ensure the 
agency's ability to perform essential functions during an emergency. 

Resources 

• Interoperable communications. Each agency should conduct quarterly tests of its 
communications capabilities and annually exercise its ability to communicate with internal 
and external key contacts. 

. Vital records and critical information systems. 6 Each agency should perform semi-annual 
tests of plans for the recovery of vital records and critical information systems at alternate 
facilities. 

• Backup power. Each agency should ensure that its alternate facility has the ability to run 
emergency power to allow essential functions to continue in any environment. The guidance 
states that such infrastructure systems are to be tested on an annual basis. 



6 FPC 65 states that agency personnel must have access to and be able to use electronic and hard-copy records and information 
systems needed to perform their essential functions. 
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Background 

Forward Challenge 06 



FPC 65 requires FEMA to conduct a governmentwide exercise every other year as a tool to assess 
and validate federal continuity readiness. From June 19 to 22, 2006, FEMA conducted Forward 
Challenge 06, a governmentwide continuity exercise designed to allow agencies to activate their 
COOP plans, deploy essential personnel to alternate facilities, and perform essential functions as a 
means of assessing their mission readiness. FEMA guidance for this exercise required agencies to 
respond appropriately to the exercise scenarios using their existing plans. Agencies also had the 
option to test additional capabilities or address internal scenarios if they did not interfere with the 
overall exercise or the activities of other agencies. 

The scenario for the exercise involved the simulation of agency continuity response to heightened 
alert conditions involving weapons of mass destruction within the United States. During the exercise, 
each participating agency's activities were observed by an official from another agency. These 
external evaluators provided the agency they observed with a checklist indicating which activities it 
included during its participation in the exercise. Forward Challenge 06 was conducted as a 
component of TOPOFF 4, a national homeland security preparedness exercise sponsored by DHS 
designed to, among other things, exercise the national ability to prevent, respond to, and recover 
from a weapon of mass destruction incident. 
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Previous GAP Reports 



We previously reported on COOP test, training, and exercise requirements at the request of the 
Chairman, House Committee on Government Reform, 7 and determined that agency plans did not 
generally comply with FEMA's guidance regarding tests, training, and exercises. We reported that 
although a governmentwide COOP exercise hosted by FEMA in May 2004 helped agencies comply 
with test, training, and exercise requirements, few agencies had documented that they conducted 
internal tests, training, and exercises at the recommended frequency. We recommended that FEMA 
develop a methodology for individual COOP assessments that independently evaluates executive 
branch agencies' compliance with FPC 65, including the extent to which agencies plan, conduct, and 
document the necessary tests and exercises at the appropriate scope and frequency. 

In response to this recommendation, before Forward Challenge 06 FEMA coordinated independent 
evaluations of participating agency COOP plans in an effort to review the extent to which elements of 
a viable COOP capability were addressed. These assessments included a review of whether agency 
plans called for test, training, and exercise activities at the frequencies outlined in FEMA's guidance. 
FEMA included the results of these assessments in the individual agency after-action reports it 
prepared following the governmentwide exercise. 
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7 GAO, Continuity of Operations: Agency Plans Have Improved, but Better Oversight Could Assist Agencies in Preparing for 
Emergencies, GAO-05-577 (Washington, D.C.: Apr. 28, 2005), and Continuity of Operations: Selected Agencies Could Improve 
Planning for Use of Alternate Facilities and Telework during Disruptions, GAO-06-713 (Washington, D.C.: May 1 1 , 2006). 
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2008 Continuity Exercise 



FEMA is currently planning for a governmentwide continuity exercise for 2008. According to FEMA 
officials, the continuity exercise will take place over 3 days in late April 2008 and will include 
objectives similar to those of Forward Challenge 06. 
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During Forward Challenge 06, the eight agencies performed various test and exercise activities 
related to COOP plans and procedures, personnel, and resources. In many cases, agencies 
provided documentation to substantiate the specific test and exercise activities performed. However, 
in other cases, agencies reported conducting such activities but did not provide supporting 
documentation. Finally, agencies also reported not testing or exercising certain capabilities during 
the exercise. In these cases, participating agencies may have addressed these capabilities in other 
test and exercises conducted during the year, which were outside the scope of our review. The 
following slides summarize the test and exercise activities agencies conducted during the 
governmentwide exercise. 
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Plans and Procedures 



Essential Functions 

Essential functions are those functions that enable agencies to provide vital services, exercise civil 
authority, maintain the safety and well being of the general populace, and sustain the 
industrial/economic base in an emergency. 

• Four of the agencies performed at least one essential function during the exercise. Some of 
the essential functions performed included ensuring command and control of the organization 
and providing information to the public. 

• The remaining four agencies reported exercising their essential functions but did not provide 
documentation substantiating which essential functions were exercised. 
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Plans and Procedures 



Activation and Notification Procedures 

Each agency develops a decision process for determining when to activate its COOP plans and 
procedures and, following activation, must notify appropriate points of contact: COOP and non- 
COOP employees, its alternate facility, and the FEMA Operations Center. 

Activation 

• Four agencies exercised activation procedures. For example, three agencies activated their 
plans as result of a change in exercise threat level conditions. 

• Of the remaining four agencies, three reported exercising their activation procedures, but did 
not provide documentation substantiating the reported activity. 

Notification — COOP Personnel 

• Three agencies exercised notification procedures for COOP personnel. For example, one 
agency used an automated notification system to contact personnel by phone and email 
upon COOP activation. 

• Of the remaining five agencies, four reported exercising the notification of their COOP 
personnel, but did not provide documentation substantiating the reported activity. 
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Agencies Tested Various Capabilities 

Plans and Procedures 

Activation and Notification Procedures (continued) 

Notification — Non-COOP Personnel 

• One agency exercised notification procedures for non-COOP personnel by sending a mass 
e-mail notifying nonessential personnel of the exercise and activation of its COOP plan. 

• Of the remaining seven agencies, five reported exercising the notification of their non-COOP 
personnel, but did not provide documentation substantiating the reported activity. 

Notification — Alternate Facility 

• Two agencies exercised notification procedures for their alternate facilities by notifying 
personnel present at the alternate facility of COOP activation, triggering preparations. 

• Of the remaining six agencies, two reported exercising the notification of their alternate 
facility, but did not provide documentation substantiating the reported activity. 

Notification — FEMA Operations Center 

• Six agencies exercised notification procedures for the FEMA Operations Center. For 
example, one agency notified FEMA of COOP activation by e-mail one morning during the 
exercise. 

• Of the remaining two agencies, one reported exercising the notification of the FEMA 
Operations Center, but did not provide documentation substantiating the reported activity. 
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Agencies Tested Various Capabilities 

Plans and Procedures 



Comprehensive Debriefing 

A comprehensive debriefing after agency COOP exercises allows participants to identify systemic 
weaknesses in plans and procedures and recommend plan revisions. 

• All eight agencies identified strengths in their continuity capabilities and areas for 

improvement using questionnaires completed by participants or meetings with participants 
following the exercise. Each of the agencies outlined their results in bullets identifying the top 
three strengths and top three areas for improvement. For example, strengths identified by the 
agencies included conducting essential functions and the performance of alternate facility 
support staff; areas for improvement included notification procedures and communication 
with external contacts. 
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Agencies Tested Various Capabilities 

Personnel 



COOP Personnel Participation 

COOP personnel are agency officials assigned responsibility to report to an alternate site, as 
required, to perform agency essential functions. 

• Five agencies moved COOP personnel to alternate facilities to participate in the exercise. For 
example, one agency participated with 13 percent of its COOP personnel, while another 
agency participated with 89 percent. 

• The remaining three agencies reported exercising with their COOP personnel, but did not 
provide documentation substantiating the extent of COOP personnel participating in the 
exercise. 
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Agencies Tested Various Capabilities 

Resources 



Interoperable Communications 

The success of agency operations at an alternate facility depends on available and redundant 
communications with internal organizations, other agencies, critical customers, and the public. 

Communications Capabilities 

• All eight agencies tested communications capabilities during the exercise. Equipment tested 
by the agencies included secure video teleconference, phone, e-mail, and an online 
emergency collaboration system. 
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Resources 



Interoperable Communications (continued) 

Communication with Internal Contacts 

• Six agencies exercised communication with internal contacts, such as field offices, during the 
exercise. 

• The remaining two agencies reported exercising communication with internal contacts, but 
did not provide documentation substantiating the reported contacts. 

Communication with External Contacts 

• In addition, four agencies exercised communication with external contacts, such as the White 
House. 

• The remaining four agencies reported exercising communication with external contacts, but 
did not provide documentation substantiating the reported contacts. 
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Agencies Tested Various Capabilities 

Resources 



Vital Records and Critical Information Systems 

Vital records are electronic and hardcopy documents, references, records and information systems 
needed to support essential functions during an emergency. 

• Six agencies tested access to vital records during the exercise. 

• The remaining two agencies reported testing access to vital records but neither provided 
documentation substantiating the reported activities. 

Emergency Backup Power 

Emergency backup power ensures that an agency's alternate facility can allow essential functions to 
continue in any environment. 

• One agency's primary power source unintentionally went out during the exercise, triggering 
the use of backup power for several hours. 

• Of the remaining seven agencies, one agency reported testing its backup power, but did not 
provide documentation substantiating the reported test. 
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Agencies Tested Various Capabilities 

FEMA Provided Limited Guidance on Documentation 



FEMA published and disseminated an exercise plan prior to the start of Forward Challenge 06, 
outlining information regarding the scope and methodology of the exercise as well as the 
responsibilities of officials from participating agencies. Within the plan, FEMA stated that participating 
agency officials were to document issues and requirements for corrective action, significant findings 
and important observations during the Forward Challenge 06 exercise. In response, each agency we 
reviewed documented the main strengths and weaknesses of its exercise participation. 

In contrast, FEMA did not direct participating agencies to document the specific activities from their 
test and exercise programs that they conducted during Forward Challenge 06. The absence of 
guidance in this area contributed to the lack of documentation to support many of the test and 
exercise activities agencies described undertaking during Forward Challenge 06. Without adequate 
records of what has been tested during a major governmentwide exercise, agencies lack assurance 
that they have adequately tested their continuity capabilities at the frequency outlined in FEMA 
guidance, which, in turn, can limit the agencies' assurance that the procedures, people, and 
resources they need to respond to a disruption will be available when needed. Developing and 
maintaining such documentation can also reduce the potential negative impact of turnover in key 
personnel — for example, turnover caused by attrition or a change in administration — by providing 
new staff with information regarding the status of their agency's test and exercise program and 
overall continuity capability. Finally, such documentation can strengthen an agency's internal control 
capability, by ensuring that relevant, reliable, and timely information is available for management 
decision-making and for external reporting purposes such as congressional oversight. 
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Agencies took advantage of the opportunity to test a number of their continuity capabilities during 
FEMA's Forward Challenge 06 governmentwide exercise. The strengths and weaknesses each 
agency identified as a result of its participation can provide the basis for improvements in their 
continuity programs. However, in many cases, agencies reported conducting test and exercise 
activities but had not documented their efforts, due in part to FEMA's guidance not requiring them to 
do so. Without adequate records of what has been tested during a major governmentwide exercise, 
agencies may lack assurance that they have adequately tested their continuity capabilities at the 
frequency outlined in FEMA guidance, which may limit their ability to fully evaluate their readiness to 
respond to a disruption. 
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To better assist agencies in assessing their readiness to respond to disruptions, we recommend that 
the Secretary of Homeland Security direct the FEMA Director to require agencies participating in 
future governmentwide exercises to document the specific test and exercise activities conducted. 
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In written comments on a draft of this briefing, the Director of the Department of Homeland Security's 
GAO/OIG Liaison office stated that the Department agreed with our recommendation. In addition, the 
Director stated that the Department had already complied with the recommendation during Forward 
Challenge 06, citing the general guidance provided in FPC 65 as well as evaluations compiled by 
internal and external evaluators during the exercise. The Director stated further that the level of 
documentation was higher than we reported as demonstrated by external evaluations that he said 
did not meet GAO audit standards. Finally, the Director stated, with respect to our assertion that 
FEMA did not specify which aspect of an agency's test and exercise program should be included in 
the exercise, that FEMA provided guidance to departments and agencies for the overarching 
objectives of the exercise. 

We disagree that FEMA provided adequate guidance on documentation and that the level of 
documentation was higher than we reported. While the guidance provided general direction to 
agencies to document their test, training, and exercise programs, it did not specify that agencies 
were to document the extent to which each essential function and supporting capability was tested. 
In addition, we considered the results of the exercise evaluations in our analysis, but in many cases 
these evaluations did not specify which essential functions and supporting capabilities were tested 
during the exercise. The value of such documentation is not to meet GAO audit standards, as the 
Director asserts. Instead, as noted in our briefing, agencies need to fully document their exercise 
activities to ensure that they are following FEMA guidance, to mitigate the effects of potential staff 
turnover, and to ensure appropriate internal controls. Nevertheless, the Director stated that FEMA 
intends to refine its assessment program, giving specific attention to improving the level of evaluation 
documentation. 
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Regarding the Director's statement that FEMA provided guidance to departments and agencies 
through the exercise objectives and FPC 65, we agree that FEMA provided guidance that required 
agencies to respond to exercise scenarios using their continuity plans. As a result, we have revised 
the introduction and background sections of the briefing to clarify the scope of FEMAs guidance. 

The Director also provided technical comments, which we incorporated as appropriate. [The 
Director's comments are reproduced as appendix II]. 
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Attachment 1 

Agencies Reviewed 


The National Response Plan designates the following eight civilian agencies as coordinators of 
emergency support functions identified to provide support to states and other federal entities during 
national disasters. 


Agency/Coordinator 


Emergency Support Function Responsibilities 


Department of Agriculture 


Firefighting; Agriculture and Natural Resources 


Department of Energy 


Energy 


Department of Health and Human 
Services 


Public Health and Medical Services 


Department of Homeland Security 


Communications; Emergency Management; Mass Care, Housing, and 
Human Services; Urban Search and Rescue; Public Safety and Security; 
Long-Term Community Recovery and Mitigation; and External Affairs 


Department of Justice 


Public Safety and Security 


Department of Transportation 


Transportation 


Environmental Protection Agency 


Oil and Hazardous Materials Response 


General Services Administration 


Resource Support 


Source: DHS, National Response Plan (Washington, D.C.: December 2004). 
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U.S. Department of Agriculture (USDA) 

Forward Challenge 06 Test and Exercise Activities 



Test and Exercise 
Activity 


Tested and 
Documented 


Tested but Not 
Documented 


Not Tested 


USDA Action 


Plans and Procedures 


1 . Essential Functions 


X 






Exercised all 43 of its essential functions during the exercise. 


2. Activation and Notification Procedures 


a. Activation 
Procedures 


X 






Exercised its COOP activation procedures one morning during 
the exercise. 


b. COOP Personnel 
Notification 




X 




Reported exercising the notification of its COOP personnel but 
did not provide documentation substantiating this activity. 


c. Non-COOP 
Personnel 
Notification 




X 




Reported exercising the notification of its non-COOP 
personnel, but did not provide documentation substantiating 
this activity. 



i 

£GAO 

^ Arr-nnntability • Integrity • Reliability 



33 



Page 38 



GAO-08-185 Continuity of Operations 



Appendix I 

October 4, 2007, Briefing to Staff of the 
Ranking Member, House Committee on 
Oversight and Government Reform 



i 

^ G A 

"" ' Accountability - Integrity • Reliability 








Attachment 2 










U. S. Department of Agriculture 














Test and Exercise 


Tested a 
Document 


Tested but t 
Documeni 


Not Test 








Activity 


CD 3 
Q. Q. 




CD 

a. 


USDA Action 






2. Activation and Notification Procedures (continued) 






d. Alternate Facility 








Did not exercise the notification of its alternate facility during 






Notification 






X 


the exercise. According to USDA officials, personnel deployed 
to the alternate facility prior to the exercise. 






e. FEMA Operations 








Exercised the notification of the FEMA Operations Center one 






Center Notification 


X 






morning during the exercise. 






3. Debriefing 


X 






Conducted a debriefing identifying strengths and areas of 
improvement from the exercise. 


















4. COOP Personnel 


X 






Exercised with 67 of its 75 COOP personnel. This is an 89 






Participation 








percent participation rate. 






















34 



Page 39 



GAO-08-185 Continuity of Operations 



Appendix I 

October 4, 2007, Briefing to Staff of the 
Ranking Member, House Committee on 
Oversight and Government Reform 



G A O Attachment 2 

^Accountability • Integrity • Reliability 

U. S. Department of Agriculture 



Test and Exercise 
Activity 


Tested and 
Documented 


Tested but Not 
Documented 


Not Tested 


USDA Action 




5. Interoperable Communications 


a. Communications 
Capabilities 


X 






Tested multiple forms of communication capabilities, including 
telephone, fax, and e-mail. 


b. Communication 
with Internal 
Contacts 


X 






Exercised communication with internal entities, including the 
Animal and Plant Health Inspection Service. 


c. Communication 
with External 
Contacts 


X 






Exercised communication with external contacts, including the 
White House. 


6. Vital Records 


X 






Tested access to vital records pre-positioned at the alternate 
facility. 


7. Backup Power 




X 




Reported that the backup power at its alternate facility was 
tested during the exercise by the facility's host, but did not 
provide documentation substantiating this testing. 
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Department of Energy (DOE) 

Forward Challenge 06 Test and Exercise Activities 



Test and Exercise 
Activity 


Tested and 
Documented 


Tested but Not 
Documented 


Not Tested 


DOE Action 


Plans and Procedures 


1 . Essential Functions 




X 




Reported exercising its essential functions but did not provide 
documentation substantiating which essential functions were 
performed during the exercise. 


2. Activation and Notification Procedures 


a. Activation 
Procedures 


X 






Exercised its COOP activation procedures one morning during 
the exercise. 


b. COOP Personnel 
Notification 




X 




Reported exercising the notification of its COOP personnel but 
did not provide documentation substantiating this activity. 


c. Non-COOP 
Personnel 
Notification 




X 




Reported exercising the notification of its non-COOP personnel 
but did not provide documentation substantiating this activity. 



36 



Attachment 3 

Department of Energy 



Page 41 



GAO-08-185 Continuity of Operations 



Appendix I 

October 4, 2007, Briefing to Staff of the 
Ranking Member, House Committee on 
Oversight and Government Reform 



G A O Attachments 

^Accountability • Integrity • Reliability 

Department of Energy 



Test and Exercise 
Activity 


Tested and 
Documented 


Tested but Not 
Documented 


Not Tested 


DOE Action 


2. Activation and Notification Procedures (continued) 


d. Alternate Facility 
Notification 






X 


Did not exercise the notification of its alternate facility. 


e. FEMA Operations 
Center Notification 


X 






Exercised notification of the FEMA Operations Center one 
morning during the exercise. 


3. Debriefing 


X 






Used questionnaires completed by exercise participants that 
identified main strengths and areas for improvement. 




4. COOP Personnel 
Participation 




X 




Reported exercising with over 220 personnel during the course 
of the exercise, but did not provide documentation 
substantiating a level of participation by COOP personnel. 
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Department of Energy 






Test and Exercise 
Activity 


Tested and 
Documented 


Tested but Not 
Documented 


Not Tested 


DOE Action 










5. Interoperable Communications 




a. Communications 
Capabilities 


X 






Tested communications capabilities, including satellite phones 
and secure video teleconferencing. 


b. Communication 
with Internal 
Contacts 


X 






Exercised communication with internal contacts, including 
agency personnel using a web-based communication tool. 


c. Communication 
with External 
Contacts 


X 






Exercised communication with external contacts, including 
other agencies such as the Nuclear Regulatory Commission. 


6. Vital Records 


X 






Tested access to vital records during the exercise. 


7. Backup Power 






X 


Did not test backup power during the exercise. 
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Department of Health and Human Services 



Department of Health and Human Services (HHS) 

Forward Challenge 06 Test and Exercise Activities 



Test and Exercise 
Activity 


Tested and 
Documented 


Tested but Not 
Documented 


Not Tested 


HHS Action 




1 . Essential Functions 


X 






Exercised one of its essential functions during the exercise. 


2. Notification Procedures 


a. Activation 
Procedures 




X 




Reported exercising activation procedures but did not provide 
documentation substantiating this activity. 


b. COOP Personnel 
Notification 




X 




Reported exercising notification procedures for COOP 
personnel but did not provide documentation substantiating this 
activity. 


c. Non-COOP 
Personnel 
Notification 




X 




Reported exercising non-COOP personnel notification 
procedures, but did not provide documentation substantiating 
this activity. 
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Department of Health and Human Services 



Test and Exercise 


Tested a 
Documeni 


Tested but I s 
Documeni 


Not Tesl 




Activity 


a a. 




CD 

a 


HHS Action 


2. Activation and Notification Procedures (continued) 


d. Alternate Facility 








Reported exercising notification procedures for the alternate 


Notification 




X 




facility but did not provide documentation substantiating this 
activity. 


e. FEMA Operations 


X 






Exercised the notification of the FEMA Operations Center 


Center 








during the exercise. 


3. Debriefing 


X 






Conducted a debriefing and provided a summary list of 
strengths and areas for improvement. 


Personnel 










4. COOP Personnel 


X 








Deployed 105 COOP personnel for the exercise. 


Participation 
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Department of Health and Human Services 



Test and Exercise 
Activity 


Tested and 
Documented 


Tested but Not 
Documented 


Not Tested 


HHS Action 




5. Interoperable Communications 


a. Communications 
Capabilities 


X 






Tested several communications capabilities, including 
telephone and fax. 


b. Communication 
with Internal 
Contacts 


X 






Exercised communication with internal entities, such as the 
Centers for Disease Control and Prevention. 


c. Communication 
with External 
Contacts 


X 






Exercised communication with external contacts, such as the 
Homeland Security Operations Center. 


6. Vital Records 


X 






Tested access to vital records during the exercise. 


7. Backup Power 






X 


Did not test backup power during the exercise. HHS reported 
that backup power is tested on a monthly basis at the alternate 
facility. 
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Department of Homeland Security 



Department of Homeland Security (DHS) 

Forward Challenge 06 Test and Exercise Activities 



Test and Exercise 
Activity 


Tested and 
Documented 


Tested but Not 
Documented 


Not Tested 


DHS Action 


Plans and Procedures 


1 . Essential Functions 




X 




Reported exercising its essential functions, but did not provide 
documentation substantiating this activity. 


2. Activation and Notification Procedures 


a. Activation 
Procedures 




X 




Reported exercising its activation procedures, but did not 
provide documentation substantiating this activity. 


b. COOP Personnel 
Notification 


X 






Exercised the notification of its COOP personnel. 


c. Non-COOP 
Personnel 
Notification 




X 




Reported that DHS headquarters COOP team personnel 
provided notification and individual instructions to non-COOP 
personnel within their respective organizations. DHS did not 
provide documentation substantiating this activity. 
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G A O Attachments 

^Accountability • Integrity • Reliability 

Department of Homeland Security 



Test and Exercise 
Activity 


Tested and 
Documented 


Tested but Not 
Documented 


Not Tested 


DHS Action 


2. Activation and Notification Procedures (continued) 


d. Alternate Facility 
Notification 


X 






Exercised the notification of its alternate facility. 


e. FEMA Operations 
Center Notification 




X 




Reported exercising the notification of the FEMA Operations 
Center, but did not provide documentation substantiating this 
activity. 


3. Debriefing 


X 






Conducted a debriefing identifying strengths and areas of 
improvement from the exercise. 


Personnel 


4. COOP Personnel 
Participation 


X 






Exercised with 24 of its 184 COOP personnel. This is a 13 
percent participation rate. DHS officials stated that additional 
COOP personnel participated in the exercise, but did not sign 
in. 
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G A O Attachments 

^Accountability • Integrity • Reliability 

Department of Homeland Security 



Test and Exercise 
Activity 


Tested and 
Documented 


Tested but Not 
Documented 


Not Tested 


DHS Action 




5. Interoperable Communications 


a. Communications 
Capabilities 


X 






Tested its communications capabilities, including secure video 
teleconferencing. 


b. Communication 
with Internal 
Contacts 




X 




Reported exercising communication with internal contacts as it 
exercised essential functions, but did not provide 
documentation substantiating the communication. 


c. Communication 
with External 
Contacts 




X 




Reported exercising communication with external contacts as it 
exercised essential functions, but did not provide 
documentation substantiating the communication. 


6. Vital Records 




X 




Reported testing access to its vital records, but did not provide 
documentation substantiating this testing. 


7. Backup Power 






X 


Did not test its backup power during the exercise. DHS 
reported that the host of the alternate facility conducts regular 
tests of the backup power. 
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Attachment 6 

Department of Justice 



Department of Justice (DOJ) 

Forward Challenge 06 Test and Exercise Activities 



Test and Exercise 
Activity 


Tested and 
Documented 


Tested but Not 
Documented 


Not Tested 


DOJ Action 


Plans and Procedures 


1 . Essential Functions 




X 




Reported exercising its essential functions as if conducting a 
usual work day but did not provide documentation 
substantiating which essential functions were performed. 


2. Activation and Notification Procedures 


a. Activation 
Procedures 






X 


Reported that exercising activation procedures was not part of 
the agency's exercise plan. 


b. COOP Personnel 
Notification 






X 


Reported that exercising notification procedures was not part of 
the agency's exercise plan. 


c. Non-COOP 
Personnel 
Notification 






X 


Reported that exercising notification procedures was not part of 
the agency's exercise plan. 
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G A O Attachments 

^Accountability • Integrity • Reliability 

Department of Justice 



Test and Exercise 
Activity 


Tested and 
Documented 


Tested but Not 
Documented 


Not Tested 


DOJ Action 


2. Activation and Notification Procedures (continued) 


d. Alternate Facility 
Notification 






X 


Reported that exercising notification procedures was not part of 
the agency's exercise plan. 


e. FEMA Operations 
Center Notification 






X 


Reported that exercising notification procedures was not part of 
the agency's exercise plan. 


3. Debriefing 


X 






Conducted a debriefing and provided a summary list of 
strengths and areas for improvement. 


Personnel 


4. COOP Personnel 
Participation 




X 




Reported exercising with COOP personnel but did not provide 
documentation substantiating this activity. 
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Attachment 6 

Department of Justice 



Test and Exercise 
Activity 


Tested and 
Documented 


Tested but Not 
Documented 


Not Tested 


DOJ Action 




5. Interoperable Communications 


a. Communications 
Capabilities 


X 






Tested multiple communication capabilities including cell 
phones, and a secure radio system. 


b. Communication 
with Internal 
Contacts 


X 






Exercised communication with internal entities, including the 
U.S. Marshals Service. 


c. Communication 
with External 
Contacts 




X 




Reported exercising communication with external contacts as it 
exercised essential functions, but did not provide 
documentation substantiating the communication. 


6. Vital Records 


X 






Tested access to vital records during the exercise. 


7. Backup Power 






X 


Did not test its backup power capabilities during the exercise. 
DOJ stated that the alternate facility's backup power is tested 
regularly by the site host. 
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Attachment 7 

Department of Transportation 



Department of Transportation (DOT) 

Forward Challenge 06 Test and Exercise Activities 



Test and Exercise 
Activity 


Tested and 
Documented 


Tested but Not 
Documented 


Not Tested 


DOT Action 


Plans and Procedures 


1 . Essential Functions 




X 




Reported exercising its essential functions, but did not provide 
documentation substantiating which functions were performed 
during the exercise. 


2. Activation and Notification Procedures 


a. Activation 
Procedures 




X 




Reported exercising its activation procedures, but did not 
provide documentation substantiating this activity. 


b. COOP Personnel 
Notification 




X 




Reported notifying 90 percent of its COOP personnel through 
its alert system, but did not provide documentation 
substantiating the notification. 


c. Non-COOP 
Personnel 
Notification 






X 


Did not test the notification of its non-COOP personnel during 
the exercise. 
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G A O Attachment? 

^Accountability • Integrity • Reliability 

Department of Transportation 



Test and Exercise 
Activity 


Tested and 
Documented 


Tested but Not 
Documented 


Not Tested 


DOT Action 


2. Activation and Notification Procedures (continued) 


d. Alternate Facility 
Notification 






X 


Did not exercise the notification of its alternate facility. DOT 
officials reported that the notification of the alternate facility was 
not applicable to the exercise because the facility managers 
were the leaders of the exercise. 


e. FEMA Operations 
Center Notification 


X 






Exercised the notification of the FEMA Operations Center 
during the exercise. 


3. Debriefing 


X 






Conducted a debriefing identifying strengths and areas of 
improvement from the exercise. 




4. COOP Personnel 
Participation 




X 




Reported that it exercised with 90 percent of its COOP 
personnel, but did not provide documentation substantiating 
this level of participation. 
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G A O Attachment? 

^Accountability • Integrity • Reliability 

Department of Transportation 



Test and Exercise 
Activity 


Tested and 
Documented 


Tested but Not 
Documented 


Not Tested 


DOT Action 




5. Interoperable Communications 


a. Communications 
Capabilities 


X 






Tested its communications capabilities. 


b. Communication 
with Internal 
Contacts 




X 




Reported exercising communication with internal contacts but 
did not provide documentation substantiating this 
communication. 


c. Communication 
with External 
Contacts 




X 




Reported exercising communication with external contacts but 
did not provide documentation substantiating this 
communication. 


6. Vital Records 




X 




Reported testing access to its vital records, but did not provide 
documentation substantiating the testing. 


7. Backup Power 






X 


Did not test its backup power during the exercise. According to 
DOT officials, testing backup power is the responsibility of the 
host of the alternate facility. 
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Attachment 8 

Environmental Protection Agency 



Environmental Protection Agency (EPA) 

Forward Challenge 06 Test and Exercise Activities 



Test and Exercise 
Activity 


Tested and 
Documented 


Tested but Not 
Documented 


Not Tested 


EPA Action 


Plans and Procedures 


1 . Essential Functions 


X 






Exercised seven of its eight essential functions during the 
exercise. 


2. Activation and Notification Procedures 


a. Activation 
Procedures 


X 






Exercised its COOP activation procedures. 


b. COOP Personnel 
Notification 


X 






Exercised the notification of its COOP personnel by telephone 
and e-mail. 


c. Non-COOP 
Personnel 
Notification 


X 






Exercised notification of its non-COOP personnel by sending 
an e-mail out to all EPA employees during the exercise. 
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G A O Attachments 
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Environmental Protection Agency 



Test and Exercise 
Activity 


Tested and 
Documented 


Tested but Not 
Documented 


Not Tested 


EPA Action 


2. Activation and Notification Procedures (continued) 


d. Alternate Facility 
Notification 


X 






Exercised the notification of its alternate facility by notifying 
personnel at the facility prior to COOP personnel deployment. 


e. FEMA Operations 
Center Notification 


X 






Exercised the notification of the FEMA Operations Center. 


3. Debriefing 


X 






Used questionnaires completed by exercise participants to 
identify main strengths and areas for improvement. 


Personnel 


4. COOP Personnel 
Participation 


X 






Exercised with 77 of its 109 COOP personnel. This is a 71 
percent participation rate. 
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Attachment 8 

Environmental Protection Agency 



Test and Exercise 
Activity 


Tested and 
Documented 


Tested but Not 
Documented 


Not Tested 


EPA Action 




5. Interoperable Communications 


a. Communications 
Capabilities 


X 






Tested its communications capabilities, including secure fax. 


b. Communication 
with Internal 
Contacts 


X 






Exercised communication with internal contacts, including 
agency field offices. 


c. Communication 
with External 
Contacts 


X 






Exercised communication with external contacts, including the 
Nuclear Regulatory Commission. 


6. Vital Records 


X 






Tested access to vital records during the exercise. 


7. Backup Power 


X 






Tested its backup power capabilities when its primary power 
source unintentionally went out, triggering the use of backup 
power for several hours. 
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Attachment 9 

General Services Administration 



General Services Administration (GSA) 

Forward Challenge 06 Test and Exercise Activities 



Test and Exercise 
Activity 


Tested and 
Documented 


Tested but Not 
Documented 


Not Tested 


GSA Action 


Plans and Procedures 


1 . Essential Functions 


X 






Exercised all six of its essential functions. 


2. Activation and Notification Procedures 


a. Activation 
Procedures 


X 






Exercised its activation procedures on one morning of the 
exercise. 


b. COOP Personnel 
Notification 


X 






Exercised the notification of its COOP personnel through an 
email sent on one morning of the exercise. 


c. Non-COOP 
Personnel 
Notification 




X 




Reported exercising the notification of its non-COOP personnel 
but did not provide documentation substantiating this activity. 
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G A O Attachment 9 

Accountability • Integrity • Reliability 

General Services Administration 



Test and Exercise 
Activity 


Tested and 
Documented 


Tested but Not 
Documented 


Not Tested 


GSA Action 


2. Activation and Notification Procedures (continued) 


d. Alternate Facility 
Notification 




X 




Reported exercising the notification of its alternate facility 
personnel but did not provide documentation substantiating this 
activity. 


e. FEMA Operations 
Center Notification 


X 






Exercised the notification of the FEMA Operations Center on 
one morning of the exercise. 


3. Debriefing 


X 






Used questionnaires completed by exercise participants to 
identify main strengths and areas for improvement. 


Personnel 


4. COOP Personnel 
Participation 


X 






Exercised with 92 of its 153 COOP personnel. This is a 60 
percent participation rate. 
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Accountability • Integrity • Reliability 

General Services Administration 



Test and Exercise 
Activity 


Tested and 
Documented 


Tested but Not 
Documented 


Not Tested 


GSA Action 




5. Interoperable Communications 


a. Communications 
Capabilities 


X 






Tested multiple forms of communication capabilities, including 
cell phones and email. 


b. Communication 
with Internal 
Contacts 


X 






Exercised communication with internal contacts, including non- 
COOP personnel. 


c. Communication 
with External 
Contacts 




X 




Reported exercising communication with external contacts, but 
did not provide documentation substantiating this 
communication. 


6. Vital Records 


X 






Tested access to vital records during the exercise. 


7. Backup Power 






X 


Did not test its backup power during the exercise. 
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U.S. Department of Homeland Security 

Washington. DC 20528 

(III' Homeland 
^llr Security 



November 2, 2007 

Ms. Linda D, Koontz 

Director, Information Management Issues 

U.S. Government Accountability Office 

441 G Street, NW 

Washington, D.C. 20548 

Dear Ms, Koontz: 

Thank you for the opportunity' to review and comment on the Government Accountability Office's 
(GAO's) draft report GAO 08-1 85SU entitled Continuity of Operation!:: Selected Agencies Tested 
Various Capabilities During 2006 Governmentwide Exercise. Technical comments have been provided 
under separate cover. We appreciate GAO's review of our previous comments on GAO's briefing slides 
and the changes made in this draft report in response to our comments. 

The Department of Homeland Security agrees with GAO's one recommendation "to require agencies 
participating in future government wide exercises to document the specific test and exercise activities 
conducted." Further, the Department believes that the Federal Emergency Management Agency 
(FEMA) has complied with this recommendation with respect to Forward Challenge 2006 (FC 06) and 
will continue to do so in future exercises. 

Federal Preparedness Circular 65 (FPC-65), dated June 1 5, 2004, is very specific on Federal 
Executive Branch Test, Training, and Exercise (TT&E) requirements. The FC 06 exercise was 
specifically designed to allow Departments and Agencies (D/As) to conduct their continuity of 
operations tests, training, and exercise activities in this internally and externally evaluated exercise. 
FPC 65 states on page 8 that, "All agencies must plan, conduct, and document periodic tests, 
training, and exercises to demonstrate the plan 's viability and identify deficiencies. Deficiencies 
and actions taken to correct them must be documented. " FPC 65 states on page I -1 that, "Agencies 
must develop and maintain a COOP test, training and exercise program for conducting and 
documenting TT&E." FPC 65 provides an entire annex (Annex I) directing comprehensive 
components of an agency Test. Training and Exercise programs. All agencies were provided FPC 
65 prior to the exercise. The Evaluation Plan (EVALPLAN) provided guidance to organizations to 
test and evaluate FC 06 in accordance with the standardized published Exercise Evaluation Guides 
(EEG) and the self-assessment checklist. The Exercise Evaluation Guide/self-assessment checklist, 
included specific requirements for a department and agency's COOP program. This Guide/checklist 
is very 7 specific and included Green, Yellow, and Red evaluation ratings for performance of these 
requirements. Exercise guidance was very clear that the checklist was to be used to assist the 
departments and agencies in their exercise planning/development to meet the continuity 
requirements, and that the assessment would document to the President 
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their ability to conduct these requirements. FPC 65 further requires all departments and agencies to 
document performance of continuity of operations exercise activities and include corrective actions 
m their Corrective Action Program (CAP). The FC 06 exercise was designed with the departments 
and agencies to facilitate the performance of their required essential functions and other supporting 
continuity of operations requirements. 

The eight departments/agencies reviewed by GAO for this exercise are all Level 1 and 2 
organizations and all were required to participate in the exercise, participate in the required 
assessments, with reports on their capabilities to be submitted to the President. Again, FPC 65 
requires all organizations that participate in COOP exercises to document their performance of 
exercise objectives in a Corrective Action Plan (CAP) and to develop and document corrective 
actions. 



Each agency evaluation team was made up of external and internal evaluators. The external 
evaluators were responsible for providing feedback to FEMA's National Continuity Programs (NCP) 
to develop the external After Action Reports (AARs); and the internal evaluators were provided the 
same forms/training to conduct their internal portion of the evaluation to include self-assessments on 
Primary Mission Essential Functions and internally developed Master Scenario Events Lists. They 
were also directed to prepare an internal AAR, which was to be provided to NCP. 

GAO indicated that D/As tested, but did not document, many components of their continuity 
exercises. GAO however, also acknowledged during their exit conference that many components 
were documented by external evaluators but not to GAO auditing standards. Thus, the level of 
documentation for Forward Challenge 06 was higher than reported by GAO, sufficient to evaluate 
performance and general lessons learned, but perhaps not uniformly at the level sufficient to meet 
GAO standards. 



FEMA intends to continue to refine upon its assessment program that was initiated during the Forward 
Challenge 2004 exercise, giving specific attention to improving the level of evaluation documentation. 

DHS welcomes the opportunity to provide GAO with appropriate and meaningful access so that GAO 
may effectively assess emergency preparedness and response activities. As an example. GAO observers 
were provided access to the recent TOPOFF 4 exercises which were held October 15-20. 2007. 

Thank you again for the opportunity to comment on this draft report and we look forward to working 
with you on future homeland security issues. 



Sincerely, 

Steven J. Pecinovsky 
Director 

Departmental GAO/OIG Liaison Office 
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GAO's Mission 



The Government Accountability Office, the audit, evaluation, and 
investigative arm of Congress, exists to support Congress in meeting its 
constitutional responsibilities and to help improve the performance and 
accountability of the federal government for the American people. GAO 
examines the use of public funds; evaluates federal programs and policies; 
and provides analyses, recommendations, and other assistance to help 
Congress make informed oversight, policy, and funding decisions. GAO's 
commitment to good government is reflected in its core values of 
accountability, integrity, and reliability. 



Obtaining Copies of 
GAO Reports and 
Testimony 



The fastest and easiest way to obtain copies of GAO documents at no cost 
is through GAO's Web site (www.gao.gov). Each weekday, GAO posts 
newly released reports, testimony, and correspondence on its Web site. To 
have GAO e-mail you a list of newly posted products every afternoon, go to 
www.gao.gov and select "E-mail Updates." 



Order by Mail or Phone 



The first copy of each printed report is free. Additional copies are $2 each. 
A check or money order should be made out to the Superintendent of 
Documents. GAO also accepts VISA and Mastercard. Orders for 100 or 
more copies mailed to a single address are discounted 25 percent. Orders 
should be sent to: 

U.S. Government Accountability Office 
441 G Street NW, Room LM 
Washington, D.C. 20548 



To order by Phone: 



Voice: (202) 512-6000 
TDD: (202) 512-2537 
Fax: (202)512-6061 



To Report Fraud, 
Waste, and Abuse in 
Federal Programs 



Contact: 

Web site: www.gao.gov/fraudnet/fraudnet.htm 
E-mail: fraudnet@gao.gov 

Automated answering system: (800) 424-5454 or (202) 512-7470 



Congressional 
Relations 



Gloria Jarmon, Managing Director, jarmong@gao.gov, (202) 512-4400 
U.S. Government Accountability Office, 441 G Street NW, Room 7125 
Washington, D.C. 20548 



Public Affairs 



Chuck Young, Managing Director, youngcl@gao.gov, (202) 512-4800 
U.S. Government Accountability Office, 441 G Street NW, Room 7149 
Washington, D.C. 20548 
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